Detections
Analytics

SCA: security update for github.com/osrg/gobgp/v4 (GHSA-vm3g-8xwv-mxfp)

medium Tenable Self-Hosted Container Security Plugin ID 441565

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function
 SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3
 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed
 from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is
 f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component. (CVE-2026-7734)

Solution

Update the github.com/osrg/gobgp/v4 library and its related packages to version 4.4.0 or later.

See Also

https://github.com/advisories/GHSA-vm3g-8xwv-mxfp

Plugin Details

Severity: Medium

ID: 441565

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 5/8/2026

Updated: 6/22/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.44

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-7734

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/4/2026

Vulnerability Publication Date: 5/4/2026

Reference Information

CVE: CVE-2026-7734

cwe: CWE-404